v157 · sanitizer api · basic / canonical
javascript: URL playground
One input, four real call shapes. The markup below goes through the actual Sanitizer API in your browser — no simulation — and the page diffs which javascript: navigation URLs survived. The interesting row is the third one: setHTMLUnsafe() with javascriptURLs: false is the configuration that was impossible to express before Chrome 157.
Probing this browser…
Run the sanitizer
Not run yet.
What actually came out
| element | attribute | input value | outcome |
|---|
Serialized output
Rendered preview (navigation disabled in this preview — clicks on links are intercepted):
What Chrome 157 would do (per spec — not a live result)
This browser could not run the call for real (see the status above), so the table below is the specified outcome from HTML PR 12898, clearly labelled as such — nothing here executed.
| call shape | javascriptURLs canonicalises to | javascript: hrefs in output |
|---|---|---|
| setHTML(input) | false (safe default) | removed |
| setHTML(input, {sanitizer:{javascriptURLs:true}}) | false — removeUnsafe() overrides | removed |
| setHTMLUnsafe(input, {sanitizer:{javascriptURLs:false}}) | false (explicit — NEW) | removed |
| setHTMLUnsafe(input, {sanitizer:{}}) | true (unsafe default) | kept |
the code
// The newly expressible configuration: keep what the unsafe path keeps
// (comments, data-*, <script> elements as inert markup) but still strip
// javascript: navigation URLs.
el.setHTMLUnsafe(untrusted, { sanitizer: { javascriptURLs: false } });
// Safe calls are unaffected: removeUnsafe() forces javascriptURLs to false,
// so this still strips them despite the explicit true:
el.setHTML(untrusted, { sanitizer: { javascriptURLs: true } });